Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1030 Data Transfer Size Limits |
ToolRclone | The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits. |
| T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
ToolRclone | Rclone can exfiltrate data over SFTP or HTTPS via WebDAV. |
| T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol |
ToolRclone | Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV. |
| T1083 File and Directory Discovery |
ToolRclone | Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands. |
| T1560.001 Archive via Utility |
ToolRclone | Rclone can compress files using `gzip` prior to exfiltration. |
| T1567.002 Exfiltration to Cloud Storage |
ToolRclone | Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
